Key points
- Rapid7 discovered three vulnerabilities in Eptura Archibus, including a critical remote code execution flaw.
- An authentication bypass allows attackers to run functions without credentials, leading to database reads.
- Eptura has released a fix for these issues, which affect versions prior to the patched release.
Eptura Archibus users can now install a security update that fixes three vulnerabilities discovered by Rapid7. The most severe flaw is a critical remote code execution issue with a CVSS score of 9.6. Another high-severity flaw allows attackers to bypass authentication entirely. A third high-severity issue permits unauthorized reading of the entire database.
In plain English
Attackers with network access to an Archibus server can exploit these flaws to take full control of the system. By bypassing authentication, they can execute system commands as a local service account. They can also read sensitive data, including passwords and secrets, directly from the database. The critical flaw stems from an insecure file upload mechanism.
The background
Rapid7 found these issues while performing continuous red teaming exercises through its Vector Command service. Security consultant Marcus Chang discovered that a legacy API endpoint allowed unauthenticated access. The Web Central application uses Java Direct Web Remoting for API functionality. Attackers can chain the authentication bypass with other flaws to escalate their access.
What changes now
Eptura has released a patch that resolves all three vulnerabilities. Organizations running Archibus should update their systems immediately to close these security gaps. The update prevents attackers from bypassing authentication and executing arbitrary code. It also stops unauthorized access to database records.
Who needs to act first
Teams should prioritize updating systems that are directly accessible from the internet or untrusted networks. Before applying the patch, verify that the update is compatible with your current configuration and custom workflows. Create a full backup of the Archibus database and application files to ensure you can restore service if the update fails. Test the update in a non-production environment first to confirm stability. Monitor server logs for any unusual activity during the rollout process.
What to do and how to stay safe: Eptura
- Check your Eptura Archibus version against the vendor’s advisory to confirm if you are affected.
- Apply the security update as soon as possible to patch the authentication bypass and remote code execution flaws.
- Review server logs for signs of unauthorized access or unusual file uploads while waiting to apply the fix.
- Restrict network access to the Archibus server to trusted IP addresses only until the patch is deployed.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the most severe vulnerability?
The insecure file upload leading to remote code execution has a CVSS score of 9.6, rated as Critical.
Which company discovered these vulnerabilities in Eptura Archibus?
Rapid7 discovered the vulnerabilities through its Vector Command service, with Marcus Chang credited for the finding.
Can attackers read database contents without authentication?
Yes, an authentication bypass flaw allows attackers to run workflow rules that read any database table, including passwords.
